ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fancy 3.3.7, fix 5.6.5

Browse source
This commit is contained in:
root@DERVISHx 2023-10-10 16:56:00 +01:00
parent aaa05fa672
commit 9643e234cf
2 changed files with 8 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tasks/post.yml
View file

@ -27,18 +27,13 @@
- "'procps-ng' in ansible_facts.packages" - "'procps-ng' in ansible_facts.packages"
- name: POST | Update usr sysctl - name: POST | Update usr sysctl
block: ansible.builtin.lineinfile:
- name: POST | Set default.rp_filter dest: /usr/lib/sysctl.d/50-default.conf
ansible.builtin.lineinfile: regexp: "{{ item.regexp }}"
path: /usr/lib/sysctl.d/50-default.conf line: "{{ item.line }}"
regexp: '^net.ipv4.conf.default.rp_filter' loop:
line: net.ipv4.conf.default.rp_filter = 1 - { regexp: '^net.ipv4.conf.default.rp_filter', line: 'net.ipv4.conf.default.rp_filter = 1' }
- { regexp: '^net.ipv4.conf.*.rp_filter', line: 'net.ipv4.conf.*.rp_filter = 1' }
- name: POST | Set ALL rp_filter
ansible.builtin.lineinfile:
path: /usr/lib/sysctl.d/50-default.conf
regexp: '^net.ipv4.conf.*.rp_filter'
line: net.ipv4.conf.*.rp_filter = 1
when: when:
- rhel9cis_sysctl_update - rhel9cis_sysctl_update
- not system_is_container - not system_is_container

2
tasks/section_5/cis_5.6.x.yml
View file

@ -101,7 +101,7 @@
- name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask on sessions /etc/pam.d/system-auth" - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask on sessions /etc/pam.d/system-auth"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/pam.d/system-auth path: /etc/pam.d/system-auth
line: 'session\trequired\t\t\tpam_umask.so' line: 'session required pam_umask.so'
insertafter: EOF insertafter: EOF
when: when:
- rhel9cis_rule_5_6_5 - rhel9cis_rule_5_6_5